3 ms·

DoH is the simple idea that instead of proxying your DNS request to whatever and whoever is configured by the local network operator, usually the ISP, we will p

by belorn 6y ago

DoH is the simple idea that instead of proxying your DNS request to whatever and whoever is configured by the local network operator, usually the ISP, we will proxy it to google under https if you use chrome or cloudflare if you use firefox. (Technically both browsers allow for this setting to be overwritten) Once the proxied package arrive at google/cloudflare it is back to normal dns operations. An other way to see it is that DoH is a https based VPN that the browser has chosen for you, but which only proxy dns traffic. Fixing the dns protocol is what DoT is for, and especially aDoT which would allow in the future for end-to-end encryption between end user and DNS server. Sadly aDoT is only a draft right now, and there is a lot of resistance to the idea of moving away from the caching proxy model.

tptacek 6y ago
This is obviously incorrect, right? Google has ad nauseam repeated that they're not shifting Chrome users to Google DNS, but rather upgrading users to DoH iff their current provider supports it. How does that fact not refute your central claim here?
- belorn 6y ago
  The central claim is that doh operate identical to the communication between the stub resolver and the recursive resolver, and it is simply the client proxying the resolving request to a third party. The specific transport layer, that of https, is basically irrelevant to the security design of the dns protocol itself which is unaware if it got proxied through https, by unencrypted udp packages, or tunneled through a vpn service. The default behavor of chrome is to automatically use their DoH service if the users broadband ISP supports it. I don't dispute that or intended to comment on it. If my above comment implied something else I am sorry as that was not the intention nor the central message of the comment. The comment was not a critique of googles default choice in chrome, but rather an attempt to explain how DoH relate to the DNS protocol and how aDoT, which is based on DoT, might actually fix the security faults of the dns protocol by enabling end-to-end encryption between the user and the dns server.
  - tptacek 6y ago
    The comment you wrote upthread said literally the opposite, both of what you just wrote here, and of the truth, which is, of course, that Google is not in fact redirecting or proxying DNS requests for Chrome users back to Google.
    - belorn 6y ago
      Good thing then that was not the intent. Do you have anything to say the aspect of proxying dns to a third party, or the possibility of end-to-end encryption in dns?
      - tptacek 6y ago
        I think that DoH and DoT do essentially the same thing, and that the only meaningful difference is that DoT was designed with a kill switch for network operators to overrule applications running on computers. As an owner of a computer, I would rather not give AT&T, let alone a random coffee shop or hotel, the ability to disable my secure lookups; obviously, I think DoH is the better plan. Fortunately, it appears to be roflstomping DoT in the marketplace.
        belorn 6y ago
        DoH and DoT are both using the design of using a third party that is an caching proxy, and neither allow for end-to-end encryption between the client and the authoritative dns server. With end-to-end encryption there is no kill switch, so that would make it a rather huge practical difference between aDoT and DoT. It also provide confidentiality which is a much better design for privacy than DoH. As an owner of an computer, are you against end-to-end encryption for dns, or in favor of end-to-end encryption? You comment above does not answer that question.
        belorn 6y ago
        It is interesting that people have such negative reaction to the idea of end-to-end encryption in dns. I can think of very few other technical areas where having secure communication between the client and server without the involvement of third parties is seen as something bad and who ever suggest it should be shunned. Given how that is, I wonder how people would react to the idea of using even stronger security like off-the-Record Messaging.

by belorn 6y ago

tptacek 6y ago

This is obviously incorrect, right? Google has ad nauseam repeated that they're not shifting Chrome users to Google DNS, but rather upgrading users to DoH iff their current provider supports it. How does that fact not refute your central claim here?

belorn 6y ago
The central claim is that doh operate identical to the communication between the stub resolver and the recursive resolver, and it is simply the client proxying the resolving request to a third party. The specific transport layer, that of https, is basically irrelevant to the security design of the dns protocol itself which is unaware if it got proxied through https, by unencrypted udp packages, or tunneled through a vpn service. The default behavor of chrome is to automatically use their DoH service if the users broadband ISP supports it. I don't dispute that or intended to comment on it. If my above comment implied something else I am sorry as that was not the intention nor the central message of the comment. The comment was not a critique of googles default choice in chrome, but rather an attempt to explain how DoH relate to the DNS protocol and how aDoT, which is based on DoT, might actually fix the security faults of the dns protocol by enabling end-to-end encryption between the user and the dns server.
- tptacek 6y ago
  The comment you wrote upthread said literally the opposite, both of what you just wrote here, and of the truth, which is, of course, that Google is not in fact redirecting or proxying DNS requests for Chrome users back to Google.
  - belorn 6y ago
    Good thing then that was not the intent. Do you have anything to say the aspect of proxying dns to a third party, or the possibility of end-to-end encryption in dns?
    - tptacek 6y ago
      I think that DoH and DoT do essentially the same thing, and that the only meaningful difference is that DoT was designed with a kill switch for network operators to overrule applications running on computers. As an owner of a computer, I would rather not give AT&T, let alone a random coffee shop or hotel, the ability to disable my secure lookups; obviously, I think DoH is the better plan. Fortunately, it appears to be roflstomping DoT in the marketplace.
      - belorn 6y ago
        DoH and DoT are both using the design of using a third party that is an caching proxy, and neither allow for end-to-end encryption between the client and the authoritative dns server. With end-to-end encryption there is no kill switch, so that would make it a rather huge practical difference between aDoT and DoT. It also provide confidentiality which is a much better design for privacy than DoH. As an owner of an computer, are you against end-to-end encryption for dns, or in favor of end-to-end encryption? You comment above does not answer that question.
        belorn 6y ago
        It is interesting that people have such negative reaction to the idea of end-to-end encryption in dns. I can think of very few other technical areas where having secure communication between the client and server without the involvement of third parties is seen as something bad and who ever suggest it should be shunned. Given how that is, I wonder how people would react to the idea of using even stronger security like off-the-Record Messaging.